{"id":"CVE-2024-22020","aliases":["ALPINE-CVE-2024-22020","ALSA-2024:5814","ALSA-2024:5815","ALSA-2024:6147","ALSA-2024:6148","AZL-43195","AZL-43216","BELL-CVE-2024-22020","BIT-node-2024-22020","BIT-node-min-2024-22020","CLSA-2025-1756932817","CLSA-2026-1771494125","DEBIAN-CVE-2024-22020","DSA-5991-1","EUVD-2024-19626","GHSA-ch4x-f5c4-36gv","MGASA-2024-0282","OESA-2025-1199","OESA-2025-1200","RHSA-2024:5814","RHSA-2024:5815","RHSA-2024:6147","RHSA-2024:6148","RLSA-2024:5814","RLSA-2024:5815","RLSA-2024:6147","RLSA-2024:6148","ROOT-OS-DEBIAN-12-CVE-2024-22020","SUSE-SU-2024:2496-1","SUSE-SU-2024:2542-1","SUSE-SU-2024:2543-1","SUSE-SU-2024:2574-1","UBUNTU-CVE-2024-22020","openSUSE-SU-2024:14214-1","openSUSE-SU-2024:14435-1","openSUSE-SU-2025:15802-1","openSUSE-SU-2026:11110-1"],"status":"published","title":"A security flaw in Node.js  allows a bypass of network import restrictions.\nBy embedding non...","description":"A security flaw in Node.js  allows a bypass of network import restrictions.\nBy embedding non-network imports in data URLs, an attacker can execute arbitrary code, compromising system security.\nVerified on various platforms, the vulnerability is mitigated by forbidding data URLs in network imports.\nExploiting this flaw can violate network import security, posing a risk to developers and servers.","severity":{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.01104,"percentile":0.65999,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-284","CWE-94"],"published":"2024-07-09T01:07:28Z","modified":"2026-11-02T12:01:22Z","fixes":[{"ecosystem":"Alpine:v3.19","package":"nodejs","fixed_in":["20.15.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"nodejs","fixed_in":["20.15.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"nodejs","fixed_in":["20.15.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"nodejs","fixed_in":["20.15.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"nodejs","fixed_in":["20.15.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"nodejs","fixed_in":["20.15.1-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"nodejs","fixed_in":["20.14.0-5"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"nodejs18","fixed_in":["18.20.3-3"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"nodejs","fixed_in":["18.20.4-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"nodejs","fixed_in":["20.15.1-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:23","package":"nodejs","fixed_in":["18.20.4-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:stream","package":"nodejs","fixed_in":["20.15.1-r0"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"node","fixed_in":["18.20.4","20.15.1","22.4.1"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"node-min","fixed_in":["18.20.5","20.18.1","22.12.0"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"nodejs","fixed_in":["1:16.20.2-3.el9_2.tuxcare.els5"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"nodejs-devel","fixed_in":["1:16.20.2-3.el9_2.tuxcare.els5"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"nodejs-docs","fixed_in":["1:16.20.2-3.el9_2.tuxcare.els5"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"nodejs-full-i18n","fixed_in":["1:16.20.2-3.el9_2.tuxcare.els5"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"nodejs-libs","fixed_in":["1:16.20.2-3.el9_2.tuxcare.els5"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"npm","fixed_in":["1:8.19.4_1.16.20.2-3.el9_2.tuxcare.els5"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"v8-devel","fixed_in":["2:9.4.146.26_1.16.20.2-3.el9_2.tuxcare.els5"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"nodejs","fixed_in":["1:16.20.2-8.el9_6.tuxcare.els7"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"nodejs-devel","fixed_in":["1:16.20.2-8.el9_6.tuxcare.els7"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"nodejs-docs","fixed_in":["1:16.20.2-8.el9_6.tuxcare.els7"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"nodejs-full-i18n","fixed_in":["1:16.20.2-8.el9_6.tuxcare.els7"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"nodejs-libs","fixed_in":["1:16.20.2-8.el9_6.tuxcare.els7"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"npm","fixed_in":["1:8.19.4_1.16.20.2-8.el9_6.tuxcare.els7"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"v8-devel","fixed_in":["2:9.4.146.26_1.16.20.2-8.el9_6.tuxcare.els7"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"nodejs","fixed_in":["18.20.4+dfsg-1~deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"nodejs","fixed_in":["20.15.1+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"nodejs","fixed_in":["20.15.1+dfsg-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.19","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.15.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.15.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.15.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.15.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.15.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.15.1-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.16.0-1.module_el8.10.0+3882+e12e42db"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.16.0-1.module_el8.10.0+3882+e12e42db"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.16.0-1.module_el8.10.0+3882+e12e42db"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.16.0-1.module_el8.10.0+3882+e12e42db"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.1-1.module_el8.9.0+3731+490e3ce5"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-4.module_el8.9.0+3775+d8460d35"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-4.module_el8.9.0+3775+d8460d35"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.8.1-1.20.16.0.1.module_el8.10.0+3882+e12e42db"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.16.0-1.module_el9.4.0+107+dbd477e4"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.16.0-1.module_el9.4.0+107+dbd477e4"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.16.0-1.module_el9.4.0+107+dbd477e4"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.16.0-1.module_el9.4.0+107+dbd477e4"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.1-1.module_el9.3.0+47+c33bc288"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-4.module_el9.3.0+88+29afeaa2"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-4.module_el9.3.0+88+29afeaa2"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.8.1-1.20.16.0.1.module_el9.4.0+107+dbd477e4"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.20.4-1.module_el9.4.0+112+bb28ff81"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.20.4-1.module_el9.4.0+112+bb28ff81"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.20.4-1.module_el9.4.0+112+bb28ff81"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.20.4-1.module_el9.4.0+112+bb28ff81"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.1-1.module_el9.2.0+36+853e48f5"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-4.module_el9.1.0+13+d9a595ea"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-4.module_el9.1.0+13+d9a595ea"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.7.0-1.18.20.4.1.module_el9.4.0+112+bb28ff81"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.20.4-1.module_el8.10.0+3890+5a092792"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.20.4-1.module_el8.10.0+3890+5a092792"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.20.4-1.module_el8.10.0+3890+5a092792"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.20.4-1.module_el8.10.0+3890+5a092792"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.1-1.module_el8.8.0+3613+1ed8c91d"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-4.module_el8.7.0+3343+ea2b7901"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-4.module_el8.7.0+3343+ea2b7901"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.7.0-1.18.20.4.1.module_el8.10.0+3890+5a092792"}]}],"bundled":2},{"source":"osv","ecosystem":"Azure Linux:3","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.14.0-5"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"nodejs18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.20.3-3"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"18.16.1-r0"},{"fixed":"18.20.4-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"18.16.1-r0"},{"fixed":"20.15.1-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:23","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"18.16.1-r0"},{"fixed":"18.20.4-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:stream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"18.16.1-r0"},{"fixed":"20.15.1-r0"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"node","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"18.20.4"},{"introduced":"19.0.0"},{"fixed":"20.15.1"},{"introduced":"21.0.0"},{"fixed":"22.4.1"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"node-min","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"18.20.5"},{"introduced":"19.0.0"},{"fixed":"20.18.1"},{"introduced":"21.0.0"},{"fixed":"22.12.0"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.20.2-3.el9_2.tuxcare.els5"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.20.2-3.el9_2.tuxcare.els5"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.20.2-3.el9_2.tuxcare.els5"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.20.2-3.el9_2.tuxcare.els5"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.20.2-3.el9_2.tuxcare.els5"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:8.19.4_1.16.20.2-3.el9_2.tuxcare.els5"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"v8-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:9.4.146.26_1.16.20.2-3.el9_2.tuxcare.els5"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.20.2-8.el9_6.tuxcare.els7"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.20.2-8.el9_6.tuxcare.els7"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.20.2-8.el9_6.tuxcare.els7"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.20.2-8.el9_6.tuxcare.els7"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.20.2-8.el9_6.tuxcare.els7"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:8.19.4_1.16.20.2-8.el9_6.tuxcare.els7"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"v8-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:9.4.146.26_1.16.20.2-8.el9_6.tuxcare.els7"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.20.4+dfsg-1~deb12u1"}]}],"versions":["18.13.0+dfsg1-1","18.13.0+dfsg1-1.1","18.19.0+dfsg-1","18.19.0+dfsg-2","18.19.0+dfsg-3","18.19.0+dfsg-4","18.19.0+dfsg-5","18.19.0+dfsg-6","18.19.0+dfsg-6~deb12u1","18.19.0+dfsg-6~deb12u2","18.19.1+dfsg-1","18.19.1+dfsg-2","18.19.1+dfsg-3","18.19.1+dfsg-3.1","18.19.1+dfsg-4","18.19.1+dfsg-6","18.20.1+dfsg-1","18.20.1+dfsg-2","18.20.1+dfsg-3","18.20.1+dfsg-4"]},{"source":"osv","ecosystem":"Debian:13","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.15.1+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.15.1+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.20.4+dfsg-1~deb12u1"}]}],"versions":["18.13.0+dfsg1-1","18.13.0+dfsg1-1.1","18.19.0+dfsg-1","18.19.0+dfsg-2","18.19.0+dfsg-3","18.19.0+dfsg-4","18.19.0+dfsg-5","18.19.0+dfsg-6","18.19.0+dfsg-6~deb12u1","18.19.0+dfsg-6~deb12u2","18.19.1+dfsg-1","18.19.1+dfsg-2","18.19.1+dfsg-3","18.19.1+dfsg-3.1","18.19.1+dfsg-4","18.19.1+dfsg-6","18.20.1+dfsg-1","18.20.1+dfsg-2","18.20.1+dfsg-3","18.20.1+dfsg-4"],"bundled":8},{"source":"osv","ecosystem":"Mageia:9","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.6.0-1.mga9"}]}],"bundled":5},{"source":"osv","ecosystem":"Mageia:9","package":"yarnpkg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.22-0.10.8.2.1.mga9"}]}],"bundled":5},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.18.2-1.oe2403"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.18.2-1.oe2403sp1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.16.0-1.module+el8.10.0+22203+a88c8310"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.16.0-1.module+el8.10.0+22203+a88c8310"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.16.0-1.module+el8.10.0+22203+a88c8310"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.16.0-1.module+el8.10.0+22203+a88c8310"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.16.0-1.module+el8.10.0+22203+a88c8310"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.16.0-1.module+el8.10.0+22203+a88c8310"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el8.9.0+20473+c4e3d824"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el8.9.0+19519+e25b965a"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el8.9.0+19519+e25b965a"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.8.1-1.20.16.0.1.module+el8.10.0+22203+a88c8310"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.16.0-1.module+el9.4.0+22197+9e60f127"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.16.0-1.module+el9.4.0+22197+9e60f127"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.16.0-1.module+el9.4.0+22197+9e60f127"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.16.0-1.module+el9.4.0+22197+9e60f127"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.16.0-1.module+el9.4.0+22197+9e60f127"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.16.0-1.module+el9.4.0+22197+9e60f127"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el9.3.0.z+20478+84a9f781"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.3.0+19518+63aad52d"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.3.0+19518+63aad52d"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.8.1-1.20.16.0.1.module+el9.4.0+22197+9e60f127"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.20.4-1.module+el9.4.0+22195+c221878e"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.20.4-1.module+el9.4.0+22195+c221878e"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.20.4-1.module+el9.4.0+22195+c221878e"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.20.4-1.module+el9.4.0+22195+c221878e"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.20.4-1.module+el9.4.0+22195+c221878e"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.20.4-1.module+el9.4.0+22195+c221878e"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el9.3.0+19762+d716bf3b"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.1.0+15718+e52ec601"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.1.0+15718+e52ec601"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.7.0-1.18.20.4.1.module+el9.4.0+22195+c221878e"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.20.4-1.module+el8.10.0+22199+56ea0ead"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.20.4-1.module+el8.10.0+22199+56ea0ead"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.20.4-1.module+el8.10.0+22199+56ea0ead"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.20.4-1.module+el8.10.0+22199+56ea0ead"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.20.4-1.module+el8.10.0+22199+56ea0ead"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.20.4-1.module+el8.10.0+22199+56ea0ead"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el8.10.0+21159+f5a7145d"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el8.9.0+19439+7b18b275"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el8.9.0+19439+7b18b275"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.7.0-1.18.20.4.1.module+el8.10.0+22199+56ea0ead"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.16.0-1.module+el8.10.0+1856+4cdb8df5"}]}],"bundled":4},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el8.10.0+1666+930e28e8"}]}],"bundled":4},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el8.10.0+1667+4a788d89"}]}],"bundled":4},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el9.6.0+32322+a8b1fd01"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el9.5.0+31770+0da7192d"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el9.6.0+32045+2e5d342d"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el9.6.0+32143+ae966e5b"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el9.6.0+32144+1d29a396"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el9.6.0+32185+bd121a25"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.5.0+31770+0da7192d"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.6.0+32045+2e5d342d"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.6.0+32048+5323bb50"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.6.0+32143+ae966e5b"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.6.0+32144+1d29a396"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.6.0+32185+bd121a25"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.6.0+32322+a8b1fd01"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el9.6.0+32322+a8b1fd01"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el9.5.0+31770+0da7192d"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el9.6.0+32045+2e5d342d"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el9.6.0+32143+ae966e5b"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el9.6.0+32144+1d29a396"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el9.6.0+32185+bd121a25"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.5.0+31770+0da7192d"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.6.0+32045+2e5d342d"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.6.0+32048+5323bb50"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.6.0+32143+ae966e5b"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.6.0+32144+1d29a396"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.6.0+32185+bd121a25"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.6.0+32322+a8b1fd01"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.20.4-1.module+el8.10.0+1865+67d146ca"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el8.10.0+1666+930e28e8"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el8.10.0+1667+4a788d89"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 12","package":"nodejs18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.20.4-8.24.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP5","package":"nodejs18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.20.4-150400.9.24.2"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"nodejs18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.20.4-150400.9.24.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP5","package":"nodejs20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.15.1-150500.11.12.2"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"nodejs20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.15.1-150500.11.12.2"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP6","package":"nodejs20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.15.1-150600.3.3.2"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"nodejs20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.15.1-150600.3.3.2"}]}],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["18.13.0+dfsg1-1ubuntu2","18.19.1+dfsg-2ubuntu4","18.19.1+dfsg-6ubuntu1","18.19.1+dfsg-6ubuntu2","18.19.1+dfsg-6ubuntu5"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"nodejs20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.15.1-1.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"nodejs22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.10.0-1.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"nodejs24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.11.1-2.1"}]}],"bundled":11},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"nodejs26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"26.3.1-1.1"}]}],"bundled":37}],"products":[{"vendor":"node.js","product":"node.js"},{"vendor":"nodejs","product":"node"},{"vendor":"nodejs","product":"nodejs"}],"references":[{"url":"https://hackerone.com/reports/2092749","tags":["x_transferred","web","article","report"]},{"url":"http://www.openwall.com/lists/oss-security/2024/07/11/6","tags":["x_transferred","web"]},{"url":"http://www.openwall.com/lists/oss-security/2024/07/19/3","tags":["x_transferred","web"]},{"url":"https://security.netapp.com/advisory/ntap-20241122-0006/","tags":["web","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-22020","tags":["web","advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20241122-0006"},{"url":"https://github.com/advisories/GHSA-ch4x-f5c4-36gv"},{"url":"https://security.alpinelinux.org/vuln/CVE-2024-22020","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:5814","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-22018","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-22020","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-28863","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-36137","tags":["report"]},{"url":"https://bugzilla.redhat.com/2293200","tags":["report"]},{"url":"https://bugzilla.redhat.com/2296417","tags":["report"]},{"url":"https://bugzilla.redhat.com/2296990","tags":["report"]},{"url":"https://bugzilla.redhat.com/2299281","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2024-5814.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:5815","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2024-5815.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:6147","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2024-6147.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:6148","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2024-6148.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2024-22020","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/advisories/BELL-SA-2024-43","tags":["advisory"]},{"url":"https://github.com/nodejs/node/releases/tag/v18.20.4","tags":["web"]},{"url":"https://github.com/nodejs/node/releases/tag/v20.15.1","tags":["web"]},{"url":"https://github.com/nodejs/node/releases/tag/v22.4.1","tags":["web"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2025-1756932817.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1771494125.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-22020","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2024-0282.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=33415","tags":["report"]},{"url":"https://github.com/nodejs/node/releases/tag/v22.6.0","tags":["web"]},{"url":"https://github.com/nodejs/node/releases/tag/v22.5.1","tags":["web"]},{"url":"https://github.com/nodejs/node/releases/tag/v22.5.0","tags":["web"]},{"url":"https://github.com/nodejs/node/releases/tag/v22.3.0","tags":["web"]},{"url":"https://github.com/nodejs/node/releases/tag/v22.2.0","tags":["web"]},{"url":"https://github.com/nodejs/node/releases/tag/v22.1.0","tags":["web"]},{"url":"https://github.com/nodejs/node/releases/tag/v22.0.0","tags":["web"]},{"url":"https://github.com/yarnpkg/yarn/releases/tag/v1.22.22","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1199","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-22018","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1200","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2293200","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2296417","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2296990","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2299281","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_5814.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-22018","tags":["advisory"]},{"url":"https://hackerone.com/reports/2145862","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-22020","tags":["advisory","report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-28863","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-28863","tags":["advisory"]},{"url":"https://github.com/isaacs/node-tar/security/advisories/GHSA-f5x3-32g6-xq36","tags":["article"]},{"url":"https://security.netapp.com/advisory/ntap-20240524-0005/","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-36137","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-36137","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_5815.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_6147.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_6148.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2024:5814","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2024:5815","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2024:6147","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2024:6148","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20242496-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1222665","tags":["report"]},{"url":"https://bugzilla.suse.com/1227554","tags":["report"]},{"url":"https://bugzilla.suse.com/1227560","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-22020","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27980","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36138","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20242542-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20242543-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1227561","tags":["report"]},{"url":"https://bugzilla.suse.com/1227562","tags":["report"]},{"url":"https://bugzilla.suse.com/1227563","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-22018","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36137","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-37372","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20242574-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-22020","tags":["report"]},{"url":"https://nodejs.org/en/blog/vulnerability/july-2024-security-releases#bypass-network-import-restriction-via-data-url-cve-2024-22020---medium","tags":["report"]},{"url":"https://github.com/nodejs/node/commit/24648b5769dbfa71896fa32a402ddcb8ee348a8d","tags":["report"]},{"url":"https://github.com/nodejs/node/commit/4fe0f826a80365ce2512b8193ceaa9466c288aa5A","tags":["report"]},{"url":"https://github.com/nodejs/node/commit/0881c1f01ac90006315cae5b9c38cfbf44d37e59","tags":["report"]},{"url":"https://github.com/nodejs/node/commit/4324e11935659a2ed2d17f84bc87b9c9198b4fdf","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/OWCPL7VTEVIGUDVKLEV2D2ITNTWKC4AZ/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2024-21538","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22150","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-23083","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-23085","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-23165","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-23166","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-55130","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-55131","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-55132","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-59464","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-59465","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-59466","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21637","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21710","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21712","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21713","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21714","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21715","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21716","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21717","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-22036","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48615","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48617","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48618","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48619","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48928","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48930","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48931","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48933","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48934","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48935","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48936","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2024-22020","description":"A security flaw in Node.js  allows a bypass of network import restrictions.\nBy embedding non-network imports in data URLs, an attacker can execute arbitrary code, compromising system security.\nVerified on various platforms, the vulnerability is mitigated by forbidding data URLs in network imports.\nExploiting this flaw can violate network import security, posing a risk to developers and servers.","status":"published","published":"2024-07-09T01:07:28.098Z","modified":"2025-04-30T22:25:20.702Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:34:00.254134Z"}],"euvd":[{"id":"EUVD-2024-19626","description":"A security flaw in Node.js  allows a bypass of network import restrictions.\nBy embedding non-network imports in data URLs, an attacker can execute arbitrary code, compromising system security.\nVerified on various platforms, the vulnerability is mitigated by forbidding data URLs in network imports.\nExploiting this flaw can violate network import security, posing a risk to developers and servers.","status":"published","published":"2024-07-09T01:07:28Z","modified":"2025-04-30T22:25:20Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T20:51:58.065214Z"}],"ghsa":[{"id":"GHSA-ch4x-f5c4-36gv","title":"A security flaw in Node.js  allows a bypass of network import restrictions.\nBy embedding non...","description":"A security flaw in Node.js  allows a bypass of network import restrictions.\nBy embedding non-network imports in data URLs, an attacker can execute arbitrary code, compromising system security.\nVerified on various platforms, the vulnerability is mitigated by forbidding data URLs in network imports.\nExploiting this flaw can violate network import security, posing a risk to developers and servers.","status":"published","published":"2024-07-09T03:31:44Z","modified":"2025-03-14T21:32:41Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:H","level":"medium"}],"cwes":["CWE-94","CWE-284"],"updated_at":"2026-11-02T15:00:17.776608Z"}],"nvd":[{"id":"CVE-2024-22020","description":"A security flaw in Node.js  allows a bypass of network import restrictions.\nBy embedding non-network imports in data URLs, an attacker can execute arbitrary code, compromising system security.\nVerified on various platforms, the vulnerability is mitigated by forbidding data URLs in network imports.\nExploiting this flaw can violate network import security, posing a risk to developers and servers.","status":"published","published":"2024-07-09T02:15:09.973Z","modified":"2026-06-17T07:10:33.183Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:10:10.545705Z"}],"osv":[{"id":"ALPINE-CVE-2024-22020","description":"A security flaw in Node.js  allows a bypass of network import restrictions.\nBy embedding non-network imports in data URLs, an attacker can execute arbitrary code, compromising system security.\nVerified on various platforms, the vulnerability is mitigated by forbidding data URLs in network imports.\nExploiting this flaw can violate network import security, posing a risk to developers and servers.","status":"published","published":"2024-07-09T02:15:09.973Z","modified":"2026-11-02T11:17:50.070017813Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:27:49.709457Z"},{"id":"BELL-CVE-2024-22020","status":"published","published":"2024-07-09T05:57:18.498148Z","modified":"2026-02-18T07:28:07.399468Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:19.288949Z"},{"id":"DEBIAN-CVE-2024-22020","description":"A security flaw in Node.js  allows a bypass of network import restrictions. By embedding non-network imports in data URLs, an attacker can execute arbitrary code, compromising system security. Verified on various platforms, the vulnerability is mitigated by forbidding data URLs in network imports. Exploiting this flaw can violate network import security, posing a risk to developers and servers.","status":"published","published":"2024-07-09T02:15:09.973Z","modified":"2026-11-02T12:01:22.950782097Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:41.849198Z"},{"id":"OESA-2025-1199","title":"nodejs security update","description":"Node.js is a platform built on Chrome\u0026amp;apos;s JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.\r\n\r\nSecurity Fix(es):\n\nA vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-read flag is used.\nThis flaw arises from an inadequate permission model that fails to restrict file stats through the fs.lstat API. As a result, malicious actors can retrieve stats from files that they do not have explicit read access to.\nThis vulnerability affects all users using the experimental permission model in Node.js 20 and Node.js 21.\nPlease note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.(CVE-2024-22018)\n\nA security flaw in Node.js  allows a bypass of network import restrictions.\nBy embedding non-network imports in data URLs, an attacker can execute arbitrary code, compromising system security.\nVerified on various platforms, the vulnerability is mitigated by forbidding data URLs in network imports.\nExploiting this flaw can violate network import security, posing a risk to developers and servers.(CVE-2024-22020)","status":"published","published":"2025-02-28T11:08:17Z","modified":"2026-08-18T01:18:48.145930911Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:42.253598Z"},{"id":"OESA-2025-1200","title":"nodejs security update","description":"Node.js is a platform built on Chrome\u0026amp;apos;s JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.\r\n\r\nSecurity Fix(es):\n\nA vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-read flag is used.\nThis flaw arises from an inadequate permission model that fails to restrict file stats through the fs.lstat API. As a result, malicious actors can retrieve stats from files that they do not have explicit read access to.\nThis vulnerability affects all users using the experimental permission model in Node.js 20 and Node.js 21.\nPlease note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.(CVE-2024-22018)\n\nA security flaw in Node.js  allows a bypass of network import restrictions.\nBy embedding non-network imports in data URLs, an attacker can execute arbitrary code, compromising system security.\nVerified on various platforms, the vulnerability is mitigated by forbidding data URLs in network imports.\nExploiting this flaw can violate network import security, posing a risk to developers and servers.(CVE-2024-22020)","status":"published","published":"2025-02-28T11:08:17Z","modified":"2026-08-18T01:18:48.140854716Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:42.253598Z"},{"id":"RHSA-2024:5814","title":"Red Hat Security Advisory: nodejs:20 security update","status":"published","published":"2024-10-22T02:23:52Z","modified":"2026-10-14T10:04:48Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:14.03234Z"},{"id":"RHSA-2024:5815","title":"Red Hat Security Advisory: nodejs:20 security update","status":"published","published":"2024-09-16T20:58:42Z","modified":"2026-03-18T11:36:08.436504Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:14.03234Z"},{"id":"RHSA-2024:6147","title":"Red Hat Security Advisory: nodejs:18 security update","status":"published","published":"2024-10-22T02:24:21Z","modified":"2026-10-14T10:04:51Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:14.03234Z"},{"id":"RHSA-2024:6148","title":"Red Hat Security Advisory: nodejs:18 security update","status":"published","published":"2024-10-22T02:24:08Z","modified":"2026-10-14T10:04:52Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:14.03234Z"},{"id":"RLSA-2024:5815","title":"Moderate: nodejs:20 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* nodejs: Bypass network import restriction via data URL (CVE-2024-22020)\n\n* nodejs: fs.lstat bypasses permission model (CVE-2024-22018)\n\n* nodejs: fs.fchown/fchmod bypasses permission model (CVE-2024-36137)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2024-09-17T00:55:59.307259Z","modified":"2025-10-09T05:47:31.486054Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:24.923365Z"},{"id":"RLSA-2024:6147","title":"Moderate: nodejs:18 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* node-tar: denial of service while parsing a tar file due to lack of folders depth validation (CVE-2024-28863)\n\n* nodejs: Bypass network import restriction via data URL (CVE-2024-22020)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2024-09-17T00:55:59.307259Z","modified":"2025-10-09T05:47:31.974687Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:24.923365Z"},{"id":"UBUNTU-CVE-2024-22020","description":"A security flaw in Node.js  allows a bypass of network import restrictions. By embedding non-network imports in data URLs, an attacker can execute arbitrary code, compromising system security. Verified on various platforms, the vulnerability is mitigated by forbidding data URLs in network imports. Exploiting this flaw can violate network import security, posing a risk to developers and servers.","status":"published","published":"2024-07-09T02:15:00Z","modified":"2026-04-22T14:39:30.449002Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T16:54:42.68848Z"},{"id":"ALSA-2024:5814","title":"Moderate: nodejs:20 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* node-tar: denial of service while parsing a tar file due to lack of folders depth validation (CVE-2024-28863)\n* nodejs: Bypass network import restriction via data URL (CVE-2024-22020)\n* nodejs: fs.lstat bypasses permission model (CVE-2024-22018)\n* nodejs: fs.fchown/fchmod bypasses permission model (CVE-2024-36137)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2024-08-26T00:00:00Z","modified":"2026-10-29T11:02:21.716295163Z","updated_at":"2026-11-02T15:27:52.553233Z"},{"id":"ALSA-2024:5815","title":"Moderate: nodejs:20 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* nodejs: Bypass network import restriction via data URL (CVE-2024-22020)\n* nodejs: fs.lstat bypasses permission model (CVE-2024-22018)\n* nodejs: fs.fchown/fchmod bypasses permission model (CVE-2024-36137)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2024-08-26T00:00:00Z","modified":"2026-10-29T11:31:49.752264068Z","updated_at":"2026-11-02T15:27:52.553233Z"},{"id":"ALSA-2024:6147","title":"Moderate: nodejs:18 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* node-tar: denial of service while parsing a tar file due to lack of folders depth validation (CVE-2024-28863)\n* nodejs: Bypass network import restriction via data URL (CVE-2024-22020)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2024-09-03T00:00:00Z","modified":"2026-10-29T11:32:03.737546094Z","updated_at":"2026-11-02T15:27:52.553233Z"},{"id":"ALSA-2024:6148","title":"Moderate: nodejs:18 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* node-tar: denial of service while parsing a tar file due to lack of folders depth validation (CVE-2024-28863)\n* nodejs: Bypass network import restriction via data URL (CVE-2024-22020)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2024-09-03T00:00:00Z","modified":"2026-10-29T11:02:21.501040863Z","updated_at":"2026-11-02T15:27:52.553233Z"},{"id":"AZL-43195","title":"CVE-2024-22020 affecting package nodejs for versions less than 20.14.0-5","description":"A security flaw in Node.js  allows a bypass of network import restrictions.\nBy embedding non-network imports in data URLs, an attacker can execute arbitrary code, compromising system security.\nVerified on various platforms, the vulnerability is mitigated by forbidding data URLs in network imports.\nExploiting this flaw can violate network import security, posing a risk to developers and servers.","status":"published","published":"2024-07-09T02:15:09Z","modified":"2026-06-02T05:26:23Z","updated_at":"2026-11-02T15:28:05.284713Z"},{"id":"AZL-43216","title":"CVE-2024-22020 affecting package nodejs18 for versions less than 18.20.3-3","description":"A security flaw in Node.js  allows a bypass of network import restrictions.\nBy embedding non-network imports in data URLs, an attacker can execute arbitrary code, compromising system security.\nVerified on various platforms, the vulnerability is mitigated by forbidding data URLs in network imports.\nExploiting this flaw can violate network import security, posing a risk to developers and servers.","status":"published","published":"2024-07-09T02:15:09Z","modified":"2026-04-21T04:30:54.936879Z","updated_at":"2026-11-02T15:28:05.284713Z"},{"id":"BIT-node-2024-22020","description":"A security flaw in Node.js  allows a bypass of network import restrictions.\nBy embedding non-network imports in data URLs, an attacker can execute arbitrary code, compromising system security.\nVerified on various platforms, the vulnerability is mitigated by forbidding data URLs in network imports.\nExploiting this flaw can violate network import security, posing a risk to developers and servers.","status":"published","published":"2024-07-11T07:28:44.706Z","modified":"2026-02-11T09:32:42.828029Z","updated_at":"2026-11-02T15:28:34.007508Z"},{"id":"BIT-node-min-2024-22020","description":"A security flaw in Node.js  allows a bypass of network import restrictions.\nBy embedding non-network imports in data URLs, an attacker can execute arbitrary code, compromising system security.\nVerified on various platforms, the vulnerability is mitigated by forbidding data URLs in network imports.\nExploiting this flaw can violate network import security, posing a risk to developers and servers.","status":"published","published":"2024-12-16T13:54:32.928Z","modified":"2026-02-11T09:32:41.138212Z","updated_at":"2026-11-02T15:28:34.007508Z"},{"id":"CLSA-2025-1756932817","title":"nodejs: Fix of CVE-2024-22020","description":"- CVE-2024-22020: forbid data URLs in network imports to mitigate security flaw\n  allowing bypass of network import restrictions","status":"published","published":"2025-09-03T20:53:41Z","modified":"2026-06-01T00:30:59.572473258Z","updated_at":"2026-11-02T15:43:42.025438Z"},{"id":"CLSA-2026-1771494125","title":"nodejs: Fix of CVE-2024-22020","description":"- CVE-2024-22020: lib,esm: handle bypass network-import via data","status":"published","published":"2026-02-19T09:42:09Z","modified":"2026-06-01T00:32:41.419389753Z","updated_at":"2026-11-02T15:43:43.249928Z"},{"id":"CVE-2024-22020","description":"A security flaw in Node.js  allows a bypass of network import restrictions.\nBy embedding non-network imports in data URLs, an attacker can execute arbitrary code, compromising system security.\nVerified on various platforms, the vulnerability is mitigated by forbidding data URLs in network imports.\nExploiting this flaw can violate network import security, posing a risk to developers and servers.","status":"published","published":"2024-07-09T02:15:09Z","modified":"2026-06-24T09:14:27.355796298Z","updated_at":"2026-11-02T15:44:38.577405Z"},{"id":"DSA-5991-1","title":"nodejs - security update","status":"published","published":"2025-08-29T00:00:00Z","modified":"2026-03-09T02:10:22.91486Z","updated_at":"2026-11-02T15:46:18.296714Z"},{"id":"MGASA-2024-0282","title":"Updated nodejs \u0026 yarnpkg packages fix security vulnerabilities","description":"Nodejs 22 is the new active LTS branch and 5 CVE are fixed.\nCVE-2024-36138 - Bypass incomplete fix of CVE-2024-27980 (High)\nCVE-2024-22020 - Bypass network import restriction via data URL (Medium)\nCVE-2024-22018 - fs.lstat bypasses permission model (Low)\nCVE-2024-36137 - fs.fchown/fchmod bypasses permission model (Low)\nCVE-2024-37372 - Permission model improperly processes UNC paths (Low)\nyarn package is updated with npm 10.8.2\n","status":"published","published":"2024-08-28T17:11:44Z","modified":"2026-04-16T04:40:55.567077754Z","updated_at":"2026-11-02T15:49:42.684501Z"},{"id":"openSUSE-SU-2024:14214-1","title":"corepack20-20.15.1-1.1 on GA media","description":"These are all security issues fixed in the corepack20-20.15.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-07-22T00:00:00Z","modified":"2026-02-04T02:56:34.982757Z","updated_at":"2026-11-02T16:58:36.662953Z"},{"id":"openSUSE-SU-2024:14435-1","title":"corepack22-22.10.0-1.1 on GA media","description":"These are all security issues fixed in the corepack22-22.10.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-10-29T00:00:00Z","modified":"2026-02-04T02:15:17.587107Z","updated_at":"2026-11-02T16:58:36.976155Z"},{"id":"openSUSE-SU-2025:15802-1","title":"corepack24-24.11.1-2.1 on GA media","description":"These are all security issues fixed in the corepack24-24.11.1-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-12-08T00:00:00Z","modified":"2026-03-23T04:54:11.929189Z","updated_at":"2026-11-02T16:58:38.101535Z"},{"id":"openSUSE-SU-2026:11110-1","title":"nodejs26-26.3.1-1.1 on GA media","description":"These are all security issues fixed in the nodejs26-26.3.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-06-23T00:00:00Z","modified":"2026-06-24T09:00:19.692832432Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"RLSA-2024:5814","title":"Moderate: nodejs:20 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* node-tar: denial of service while parsing a tar file due to lack of folders depth validation (CVE-2024-28863)\n\n* nodejs: Bypass network import restriction via data URL (CVE-2024-22020)\n\n* nodejs: fs.lstat bypasses permission model (CVE-2024-22018)\n\n* nodejs: fs.fchown/fchmod bypasses permission model (CVE-2024-36137)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2024-09-17T00:54:54.665652Z","modified":"2026-02-04T07:40:20.112683Z","updated_at":"2026-11-02T15:53:24.923365Z"},{"id":"RLSA-2024:6148","title":"Moderate: nodejs:18 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* node-tar: denial of service while parsing a tar file due to lack of folders depth validation (CVE-2024-28863)\n\n* nodejs: Bypass network import restriction via data URL (CVE-2024-22020)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2024-09-17T00:54:54.665652Z","modified":"2026-02-04T21:15:06.460048Z","updated_at":"2026-11-02T15:53:24.923365Z"},{"id":"ROOT-OS-DEBIAN-12-CVE-2024-22020","title":"CVE-2024-22020 in rootio-nodejs - Patched by Root","description":"Root has patched CVE-2024-22020 in the rootio-nodejs package for Root:Debian:12. Multiple fixed versions available.","status":"withdrawn","published":"2025-08-12T08:24:43Z","modified":"2026-08-27T14:00:05.31315079Z","updated_at":"2026-11-02T15:53:30.70924Z"},{"id":"SUSE-SU-2024:2496-1","title":"Security update for nodejs18","description":"This update for nodejs18 fixes the following issues:\n\nUpdate to 18.20.4:\n\n- CVE-2024-36138: Fixed CVE-2024-27980 fix bypass (bsc#1227560)\n- CVE-2024-22020: Fixed a bypass of network import restriction via data URL (bsc#1227554)\n\nChanges in 18.20.3:\n\n- This release fixes a regression introduced in Node.js 18.19.0 where http.server.close() was incorrectly closing idle connections.\n  deps:\n  - acorn updated to 8.11.3.\n  - acorn-walk updated to 8.3.2.\n  - ada updated to 2.7.8.\n  - c-ares updated to 1.28.1.\n  - corepack updated to 0.28.0.\n  - nghttp2 updated to 1.61.0.\n  - ngtcp2 updated to 1.3.0.\n  - npm updated to 10.7.0. Includes a fix from npm@10.5.1 to limit the number of open connections npm/cli#7324.\n  - simdutf updated to 5.2.4.\n\nChanges in 18.20.2:\n\n- CVE-2024-27980: Fixed command injection via args parameter of child_process.spawn without shell option enabled on Windows (bsc#1222665)\n","status":"published","published":"2024-07-16T07:33:47Z","modified":"2026-02-04T04:00:02.522822Z","updated_at":"2026-11-02T15:53:55.136363Z"},{"id":"SUSE-SU-2024:2542-1","title":"Security update for nodejs18","description":"This update for nodejs18 fixes the following issues:\n\nUpdate to 18.20.4:\n\n- CVE-2024-36138: Fixed CVE-2024-27980 fix bypass (bsc#1227560)\n- CVE-2024-22020: Fixed a bypass of network import restriction via data URL (bsc#1227554)\n\nChanges in 18.20.3:\n\n- This release fixes a regression introduced in Node.js 18.19.0 where http.server.close() was incorrectly closing idle connections.\n  deps:\n  - acorn updated to 8.11.3.\n  - acorn-walk updated to 8.3.2.\n  - ada updated to 2.7.8.\n  - c-ares updated to 1.28.1.\n  - corepack updated to 0.28.0.\n  - nghttp2 updated to 1.61.0.\n  - ngtcp2 updated to 1.3.0.\n  - npm updated to 10.7.0. Includes a fix from npm@10.5.1 to limit the number of open connections npm/cli#7324.\n  - simdutf updated to 5.2.4.\n\nChanges in 18.20.2:\n\n- CVE-2024-27980: Fixed command injection via args parameter of child_process.spawn without shell option enabled on Windows (bsc#1222665)\n","status":"published","published":"2024-07-17T07:51:37Z","modified":"2026-02-04T04:15:38.206167Z","updated_at":"2026-11-02T15:53:55.136363Z"},{"id":"SUSE-SU-2024:2543-1","title":"Security update for nodejs20","description":"This update for nodejs20 fixes the following issues:\n\nUpdate to 20.15.1:\n\n- CVE-2024-36138: Fixed CVE-2024-27980 fix bypass (bsc#1227560)\n- CVE-2024-22020: Fixed a bypass of network import restriction via data URL (bsc#1227554)\n- CVE-2024-22018: Fixed fs.lstat bypasses permission model (bsc#1227562)\n- CVE-2024-36137: Fixed fs.fchown/fchmod bypasses permission model (bsc#1227561)\n- CVE-2024-37372: Fixed Permission model improperly processes UNC paths (bsc#1227563)\n\nChanges in 20.15.0:\n\n- test_runner: support test plans\n- inspector: introduce the --inspect-wait flag\n- zlib: expose zlib.crc32()\n- cli: allow running wasm in limited vmem with --disable-wasm-trap-handler\n\nChanges in 20.14.0\n\n- src,permission: throw async errors on async APIs\n- test_runner: support forced exit\n\nChanges in 20.13.1:\n\n- buffer: improve base64 and base64url performance\n- crypto: deprecate implicitly shortened GCM tags\n- events,doc: mark CustomEvent as stable\n- fs: add stacktrace to fs/promises\n- report: add --report-exclude-network option\n- src: add uv_get_available_memory to report and process\n- stream: support typed arrays\n- util: support array of formats in util.styleText\n- v8: implement v8.queryObjects() for memory leak regression testing\n- watch: mark as stable\n","status":"published","published":"2024-07-17T07:51:52Z","modified":"2026-02-04T03:44:28.883947Z","updated_at":"2026-11-02T15:53:55.136363Z"},{"id":"SUSE-SU-2024:2574-1","title":"Security update for nodejs20","description":"This update for nodejs20 fixes the following issues:\n\nUpdate to 20.15.1:\n\n- CVE-2024-36138: Fixed CVE-2024-27980 fix bypass (bsc#1227560)\n- CVE-2024-22020: Fixed a bypass of network import restriction via data URL (bsc#1227554)\n- CVE-2024-22018: Fixed fs.lstat bypasses permission model (bsc#1227562)\n- CVE-2024-36137: Fixed fs.fchown/fchmod bypasses permission model (bsc#1227561)\n- CVE-2024-37372: Fixed Permission model improperly processes UNC paths (bsc#1227563)\n\nChanges in 20.15.0:\n\n- test_runner: support test plans\n- inspector: introduce the --inspect-wait flag\n- zlib: expose zlib.crc32()\n- cli: allow running wasm in limited vmem with --disable-wasm-trap-handler\n\nChanges in 20.14.0\n\n- src,permission: throw async errors on async APIs\n- test_runner: support forced exit\n\nChanges in 20.13.1:\n\n- buffer: improve base64 and base64url performance\n- crypto: deprecate implicitly shortened GCM tags\n- events,doc: mark CustomEvent as stable\n- fs: add stacktrace to fs/promises\n- report: add --report-exclude-network option\n- src: add uv_get_available_memory to report and process\n- stream: support typed arrays\n- util: support array of formats in util.styleText\n- v8: implement v8.queryObjects() for memory leak regression testing\n- watch: mark as stable\n","status":"published","published":"2024-07-22T10:35:15Z","modified":"2026-02-04T03:46:39.426759Z","updated_at":"2026-11-02T15:53:55.136363Z"}]}}